MakcuRecoil[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MakcuRecoil.exe
Size 1.0MB
Sample260809-vmn97abe57
SHA256 a0a5b4db1fc2788d1dc11bcd2f24a343703d5036b20f010d234660fec5ea827b
MD5 c340c2b6d5315c02416f2a2d79e7f94a
SHA1 ba2372e64a476873e5b09dcb33b883ad8e8719e6
SHA512 700d5835284e320891f3c655d23fb73a78272def10630db8bafe07c07d32be2174317336f056ca355ee627c776b0ccb8821fa03484cf25e7f0bbde296d511218
SSDEEP 24576:u0gF7U45VQojOauy5tpHcAnuRTgnwajo:tqVQoaXChcgnH
TLSH
T19835BF5AB2A940F9C066C1BCCF95A913E6B13C4417207BDB2BD0B65E2F73AD04EB6711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MakcuRecoil.exe

File Explorer

MakcuRecoil.exe

.exe 1.0MB

MakcuRecoil.exe

IMPHASH c74fc0b993abe7283cb36b9d9988790a
SHA256 a0a5b4db1fc2788d1dc11bcd2f24a343703d5036b20f010d234660fec5ea827b
MD5 c340c2b6d5315c02416f2a2d79e7f94a
SHA1 ba2372e64a476873e5b09dcb33b883ad8e8719e6
SHA512 700d5835284e320891f3c655d23fb73a78272def10630db8bafe07c07d32be2174317336f056ca355ee627c776b0ccb8821fa03484cf25e7f0bbde296d511218
SSDEEP 24576:u0gF7U45VQojOauy5tpHcAnuRTgnwajo:tqVQoaXChcgnH
TLSH
T19835BF5AB2A940F9C066C1BCCF95A913E6B13C4417207BDB2BD0B65E2F73AD04EB6711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

433328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

user32

GetAsyncKeyState LoadCursorA ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetCursorPos GetWindowRect SetWindowRgn UpdateWindow GetSystemMetrics ReleaseCapture SetCapture IsIconic SetWindowPos ShowWindow DestroyWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageA TranslateMessage EnumWindows FindWindowA GetWindowTextA

gdi32

CreateRoundRectRgn

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegEnumValueA

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW SetStdHandle CreateFileW HeapSize WriteConsoleW TerminateProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread QueryPerformanceFrequency QueryPerformanceCounter Sleep GetCurrentThread SetThreadPriority GetModuleFileNameA GetCurrentProcess ExitProcess GetModuleHandleA SetEndOfFile FlushFileBuffers ReadFile GetEnvironmentStringsW CloseHandle GetLastError ClearCommError GetCommState PurgeComm SetCommState SetCommTimeouts GetWindowsDirectoryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryA SetUnhandledExceptionFilter ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread RtlUnwind RtlPcToFileHeader RaiseException SleepConditionVariableSRW WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead FlsFree FreeEnvironmentStringsW WriteFile GetProcessHeap CreateFileA RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

614KB

Virtual Size

613KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

387KB

Virtual Size

387KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

MakcuRecoil.exe

d3d11

user32

gdi32

advapi32

setupapi

kernel32

imm32

d3dcompiler_47

generic